skilly. Buy ad slot
All skills
Community / AGENT SKILL

wmi-event-subscription-persistence

ShulkwiSEC/bb-huge
0 installs 22 GitHub stars
0

[DEPRECATED: This skill has been consolidated into wmi-event-subscriptions.] For WMI Event Subscription persistence techniques, use the comprehensive wmi-event-subscriptions skill which covers all trigger types (startup, logon, process launch, time-based), multiple consumer types (CommandLine, ActiveScript), full cleanup procedures, and OPSEC considerations.

BEFORE YOU INSTALL

Understand the trade-offs.

SECURITY REVIEW

Not yet assessed

Review the original instructions and requested permissions before installing.

No security review is available for this catalog entry yet.

SKILL QUALITY

Not yet assessed

How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.

No quality assessment is available for this catalog entry yet.

The full skill.

Original instructions from the publisher’s SKILL.md

# WMI Event Subscription Persistence — CONSOLIDATED

> **⚠️ This skill has been consolidated.** The canonical, comprehensive version is:
> **`red-teaming/persistence/wmi-event-subscriptions`**
>
> That skill includes:
> - 4 trigger types (startup, user logon, process launch, time-based)
> - 2 consumer types (CommandLineEventConsumer, ActiveScriptEventConsumer)
> - Full OPSEC guidance and cleanup procedures
> - Comprehensive Blue Team detection via Sysmon Event IDs 19/20/21
> - Decision flowchart for choosing the right approach

## When to Use
Use `wmi-event-subscriptions` instead of this skill. This entry exists for backward compatibility.

## Prerequisites
- See the `wmi-event-subscriptions` skill for full prerequisites

## Workflow
### Phase 1: Redirect to Canonical Skill
Refer to `red-teaming/persistence/wmi-event-subscriptions` for the complete workflow.

## Key Concepts
| Concept | Description |
|---------|-------------|
| Consolidated Skill | This was merged with two other WMI skills into a single comprehensive `wmi-event-subscriptions` skill |

### Proof of Concept (PoC)
```bash
# Standard payload injection format
curl -X POST https://target/api -d 'exploit=true'
```

## 🔵 Blue Team
- Deploy robust WAF rules to detect anomalies.
- Monitor logs for unusual access patterns.

## 🛡️ Remediation & Mitigation Strategy
- **Input Validation:** Sanitize and strictly type-check all inputs.
- **Least Privilege:** Constrain component execution bounds.


## 📚 Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

## References
- See `red-teaming/persistence/wmi-event-subscriptions` for all references

- [Mitre ATT&CK Reference](https://attack.mitre.org/techniques/T1546/003/)